CVE-2018-12426 WP Live Chat Support Pro <= 8.0.06 - Remote Code Execution via unrestricted file upload

CriticalCVSS 9.8 EPSS 5.0%

Published: 2018-07-02 20:00
Updated: 2026-06-17 04:37
Exploit status: No public exploit known

Description

The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.

Affected products

Product	Affected versions	Fixed in
3cx live chat	< 8.0.07	8.0.07
wordpress wp-live-chat-support-pro(WordPress)	< 8.0.07	8.0.07

References

github.com third-party-advisory
github.com exploit third-party-advisory
wpvulndb.com
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (3)

v3.1 9.8 · wordfence
v3.0 9.8 · nvd@nist.gov
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 4.98% (percentile 92.3)
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.